Outside content

Outside content is text nobody in your company wrote or checked: an email, a web page, a task sent by a webhook, through the API or synced from a tracker, and a file uploaded with an API token. Agents read it as information, never as instructions. A session that has read some is marked as having read untrusted content, and from then on its bigger actions wait for a person: tier 3 and 4 actions need review, whatever the agent's rules say. See Approvals for the floors that apply.

Each such session has an Outside content panel on its page, under the timeline. Open a session from Activity; sessions that read outside content say Read untrusted content in the list.

What tainted the session

The panel's first list says what brought outside content into the session, and when:

• “Task details”: the task it worked on came from a webhook, an intake form, the API or a tracker, or a session that had read outside content wrote it, or a file on the task came from outside your company (a tracker's, one uploaded with an API token, an email's attachment an agent saved, a screenshot a Portal person sent with a change request): the session's starting context lists such a file by its id and kind, its name marked as outside content, labelled “file from outside the company”.
• “A thread entry a tainted session wrote”: a comment or result on the task's thread that a session wrote after it had read outside content. The session reads it as data, and is tainted by it.
• “Inbox item” and “A follow-up a tainted session set”: the news that woke it may quote outside text.
• “A memory note learned from outside content”: a note an earlier tainted session saved.
• “An approval request from a tainted session”: the agent was asked to decide an approval request, and the session that asked for it had read outside content, so the arguments it would run with may carry it.
• “The tainted session it continued”: the session picked up where an earlier one stopped to wait for an approval, and that earlier session had read outside content.
• “An agent approver's note”: an agent, not a person, rejected or asked for changes to one of its actions, and the session reads that agent's note. An agent approver may have read outside content itself, so its note is read as data; a person's note is read as it is.
• “An earlier chat answer written after reading outside content”: in a Portal chat, an answer earlier in the conversation was written after reading outside content. The panel names the answer, never its words, since the conversation stays the person's.
• “Tool result”: a tool returned outside content, such as a web page, an email, or a file from outside your company (a tracker's, one uploaded with an API token, an email's attachment an agent saved, or a file a session saved after it had read outside content). It shows the tool and the step in the timeline. A tool that failed shows as “Tool error”, since its error can quote outside words too.

Each item shows the first 300 characters of what was read. Anything that looks like a password, key or token, email addresses and IP addresses are taken out before it is saved, so the panel never shows them.

What it did while tainted

The second list shows every tool call the session made after it was tainted, or every one when it started that way, and how each went:

• “Ran”, or “Ran after approval” when someone approved it first.
• “Sent for approval”, with the risk tier, the rule that applied and the safeguards that changed the outcome. Select Approval request to open it.
• “Refused by an approver”, or “Refused or failed” with what the agent was told.

What it wrote as untrusted

Anything a tainted session writes stays marked, so the next session that reads it is careful too: a task's text, comments on its thread, memory notes and follow-ups it set for itself. The third list shows them, with links to the tasks.

What next

Review held-back actions in Approvals, or see every session step by step in Activity, audit log and sessions.